Staff —

eBay fraud and me, the sequel: A pathetic end to the debacle

Customer has a fraudulent purchase tied to his e-mail account? Ban him!

In my last field report from the land of eBay fraudsters, I disclosed how some clown attempted to purchase $13,000 of LED rope lighting using an account registered with my e-mail address. Perhaps the only thing more upsetting than realizing that eBay did not properly verify the e-mail address was experiencing how little concern the company had in resolving the issue. I won't rehash the account, since you can go back and read the ridiculous tale at your convenience. I am here instead to tell you about how this matter was resolved.

Apparently, I'm a terrible, terrible person.

The banhammer drops

eBay UK said that I bid $13,000 for 500 of these lights.

More than a week after my first write-up of this little adventure, I received a series of presumably automated warnings from the AI at eBay UK. First came an ominous "MC126 NOTICE” informing me that my eBay account (note: I never had an eBay account) had been suspended because I supposedly have been "claiming to be an eBay employee when you are not, or pretending to be another member.” The notice goes on to say that "this is not permitted on eBay.”

Pretending to be an eBay employee or even another member certainly sounds nefarious. Of course, I did neither. But in that now-classic "eBay's going to put the onus on you to clean up its mess" style of customer service, the notice told me that I will never be allowed to use eBay unless I successfully appeal my suspension.

So let's consider all of the ways in which eBay UK's customer support has tried to pass the buck for something I've had absolutely nothing to do with. First, after telling them that someone registered an account and engaged in an auction using my identity, they simply told me to register another account (as if that addresses anything at all).

When I clarified that this matter was indeed a little more serious than a registration problem, eBay UK actually had the gall to suggest that I use the fraudulently registered account to contact the seller and ask for his forgiveness. This would mean that I would have to reset the password on an account that I have never used, contact a seller in my own precious time, and hope that he cancels the transaction.

(On the positive side, I did receive a notice saying that the bid associated with this bogus account of "mine" has been officially canceled. That should bring an end to those harassing e-mails demanding that I pay for a truckload of LEDs.)

To top it all off, eBay UK now tells me that I have misrepresented myself, and if I ever want to use eBay again (not to worry, I don't), I have to appeal this suspension.

As you can see, no good deed goes unpunished.

I'm left with only one rejoinder: eBay UK, you are only pretending to take user account security seriously, and frankly you should be embarrassed that individuals are able to register accounts without properly verifying e-mails in the way that nearly every other service on the Internet manages to accomplish.

Ken Fisher
Ken is the founder & Editor-in-Chief of Ars Technica. A veteran of the IT industry and a scholar of antiquity, Ken studies the emergence of intellectual property regimes and their effects on culture and innovation. Emailken@arstechnica.com//Twitter@kenfisher

So let me see if I understand this correctly. Someone impersonated you using your email address to register an account. eBay was informed of the impersonation, and then suspended the account. eBay, having carried out disciplinary action, informed the offender of the suspension using their normal method of communication: email. *facepalm*

I'm surprised that having your own high profile publishing outlet hasn't gotten someone to take notice and actually fix the problem properly. Usually big internet companies will at least care about their reputations at least that much.

Failing that, is there any way you could get their attention short of suing them in a US court? Not that you'd want to really, just an academic question.

I ran an ebay store around 6-8 years ago. Between ebay / PayPal (same company), it became clear they their customer service was shit. Even though I was paying them hundreds of $ each month in fees, whenever I had a problem, they were worse then useless. Basically, they always took the path that required them to do the least work. That meant that if I got a scam buyer who would claim the item was "not as described," PayPal would confiscate my money, refund him, and offer me effectively no recourse. And the scammer got to keep the item! Eventually, I had to stop getting emotional about it and just consider such "inventory shrinkage" part of the cost of doing ebay business.

For entities like eBay/Paypal, which seem to be devoid of any sort of common sense, you're probably better off just retaining a lawyer and serving the company with a lawsuit versus trying to navigate the quagmire that is customer service. My father did something similar and you would be amazed how quickly the situation was rectified.

I'm surprised that having your own high profile publishing outlet hasn't gotten someone to take notice and actually fix the problem properly.

Yeah, I'm thinking if Caesar ping eBay UK's PR department with links to his stories here, that there might be some more prompt attention. I think it's great that he went through the process semi-anonymously to highlight the issues (and wonder if eBay UK bothers to check for negative articles about them), but now that it's been concluded with a giant failure, making someone else there aware of this who is higher up the food chain might be good for getting the system fixed.

I am an eBay user. The customer support is horrible at best. You are on your own if you have any issues outside of the resolution center. You appear to have a strange and messed up issue.

Despite some of eBay's problems, eBay can be a great place to buy and sell stuff. I sell hard to find parts on eBay and have a 100% rating. I also buy hard to find parts, this is where i find most of my ebay related problems. I have learned from my experience to read the negative feedback on any seller before purchasing. I look at what the complaint is and if I am willing to accept those risk. For the most part I get what I am expecting in a week. Usually for a lot cheaper than I can get locally for or on most any wholesalers sites.

Basically what I'm saying is ebay may have its faults but it is a great place to buy specific items at a very low price. Don't let this fraudulent issue keep you away from the all the great deals eBay has to offer.

For entities like eBay/Paypal, which seem to be devoid of any sort of common sense, you're probably better off just retaining a lawyer and serving the company with a lawsuit versus trying to navigate the quagmire that is customer service. My father did something similar and you would be amazed how quickly the situation was rectified.

Actually retaining a lawyer'd almost certainly be more expensive than it'd be worth. The closest I'd suggest to going down that path would be, if you have a friend who works at a law office willing to do you a favor, to send a form letter nastygram on legal letterhead. It's more likely to be effective against smaller businesses/franchises (for whom the threat of being sued is more likely to terrify); but the threat of legal action is often enough to convince someone that trying to brazen it out when they know they're in the wrong isn't a good idea.

ebay + uk = shit hitting the fan....and no one wants to clean it up. They'll look at it, walk around it, point at it, but heaven forbid they do anything about it as they'll say it's not their mess to clean up, when in fact it is. ebay and paypal are such a joke of corporation that when the first article came out, I wasn't surprised at the results. There's a paypal center out where I live and I've had some friends work for that cult... I mean company in both IT and customer service. I tell ya, I've heard quite a few stories that stopped me from using their service entirely. I'm actually surprised there hasn't been a DoJ investigation in to the company and their practices. But that's what their lobbyist are there for, to keep the law looking the other way and give 'em a reach around in the process.

Ebay and their child Paypal are far worse than simply permitting fraud, they also place a christian ethos on their payment system, and ban paypal accounts of sinners. Paypal - it's just like a bank minus the FDIC. You could fill a feature story on how much bullshit paypal is.

another ars account wrote:

I'm surprised that having your own high profile publishing outlet hasn't gotten someone to take notice and actually fix the problem properly. Usually big internet companies will at least care about their reputations at least that much.

Failing that, is there any way you could get their attention short of suing them in a US court? Not that you'd want to really, just an academic question.

This guy thinks Ebay cares about their reputation. Oh this guy, you so crazy.

I don't even see how any of this truly matters. An e-mail address is not a legal address or otherwise a valid link to a personal identity. In the previous thread someone asked the ridiculous question of if Ken had checked his credit report. Nothing is going to end up on a credit report without a SSN or maybe a driver's license number.

No shit, Sherlock, but if his email account was compromised and the visible information provided was accurate to him, there was a possibility that someone was engaging in an ID theft scam along with the basic issue of signing someone up for something that they didn't sign them up for.

Suspicious activity involving your real name should always be a red flag to pull a credit report. It's free 4 times a year if you rotate through credit agencies. Why you argue against this ounce of prevention is beyond me.

Perhaps someone needs to step in with a better auction site? I mean, these days, just take payments via Square.

Or someone else with an escrow site. Buyer pays escrow, escrow notifies seller that the funds are available, seller ships item, item is recieved, funds released from escrow. These days, shouldn't be hard to largely automate. (For someone that's an actual programmer; I would have to do it in bash. )

Perhaps someone needs to step in with a better auction site? I mean, these days, just take payments via Square.

Or use Bitcoin. Bitcoin is everything that PayPal should have been, but failed to be.

Boskone wrote:

Or someone else with an escrow site. Buyer pays escrow, escrow notifies seller that the funds are available, seller ships item, item is recieved, funds released from escrow. These days, shouldn't be hard to largely automate. (For someone that's an actual programmer; I would have to do it in bash. )

I don't even see how any of this truly matters. An e-mail address is not a legal address or otherwise a valid link to a personal identity. In the previous thread someone asked the ridiculous question of if Ken had checked his credit report. Nothing is going to end up on a credit report without a SSN or maybe a driver's license number. Even with legal identifiers, Texas (and other states) recycle DL numbers, and people falsely used to end up on bad check writers' lists all the time.

If I started getting correspondence like Ken did, I would have regarded it as spam / phishing and went on my way. If I had trouble registering an account later with eBay, I would just use another e-mail address. Creating an additional SMTP or forwarding account is trivial.

So in the end, this is a complete non-issue. Solutions are plentiful, nearly effortless, and trivial.

Amen. I was wondering why it needed resolving as I read the post. Now, I have occasionally had a collector or someone get my home phone number and repeatedly call asking for someone I've never met, and that is annoying, but email is trivial to filter. Are you really going to be held liable for anything based off of an email address (unless maybe its a gpg signed email you send that is threatening or something)?

Remember, they treat everyone like this, and have worked this way for a very long time. Paypal (which eBay owns - enabling them to take a double cut from most transactions) works the same. It's just that they happened to do it to the editor of Ars this time. Most people don't have this kind of audience.

I don't even see how any of this truly matters. An e-mail address is not a legal address or otherwise a valid link to a personal identity. In the previous thread someone asked the ridiculous question of if Ken had checked his credit report. Nothing is going to end up on a credit report without a SSN or maybe a driver's license number.

No shit, Sherlock, but if his email account was compromised and the visible information provided was accurate to him, there was a possibility that someone was engaging in an ID theft scam along with the basic issue of signing someone up for something that they didn't sign them up for.

Suspicious activity involving your real name should always be a red flag to pull a credit report. It's free 4 times a year if you rotate through credit agencies. Why you argue against this ounce of prevention is beyond me.

So if someone happens to know your email address its cause for emergency? Keen didn't provide any evidence in the story other than "the fraudulent account referenced my email address".

Having had eBay / Paypal repeatedly refund money and let buyers keep items for no reason other than simple (and totally inaccurate) "not as described" complaints, none of this surprises me in the least.

I do not get it. This account was not yours, and you clearly stated that you did not want anything to do with it. Then, you get mad when EBay banned it? If they had just deleted it, then the person committing fraud could have just recreated it and then bought something else. By banning it, they made sure this could not happen again. What am I missing here?

I think it's more that he's upset being harassed by a company that he's never had anything to do with. It probably makes it more irritating when he told them right away what the mistake was, but they continued anyways, by the sound of things, for quite awhile. It would also be alarming if they had your real name as well, which they did in this case.

Regardless, it's more of a cautionary tale for those who trust eBay with their money and identity, and rely on that company to be responsible - especially if it involves the person's livelihood.

So let me see if I understand this correctly. Someone impersonated you using your email address to register an account. eBay was informed of the impersonation, and then suspended the account. eBay, having carried out disciplinary action, informed the offender of the suspension using their normal method of communication: email. *facepalm*

That's not actually how they communicate.

They communicate through the message center on eBay. It just happens to also send email to the address associated with the account.

Which, if you don't log in to eBay and read it from their message center makes it look really stupid while it's only slightly stupid.

aaronb1138 wrote:

So in the end, this is a complete non-issue. Solutions are plentiful, nearly effortless, and trivial.

While they should, at the very least, require verification of the email address prior to an account being useable, the rest is exactly as you say.

The fact that you're being downvoted for not grabbing a picthfork is merely a sad commentary on how little people really understand how eBay works.

And the real victim in all of this is the poor seller who had his auction screwed with by whatever troll used Ken's email for the fake eBay account. Ken's irritation is just collateral damage.

following on from Quasius post, ebay are supposedly running a 'buyer protection policy'. what that seems to consist of is when an item purchased is found to be faulty, the buyer and seller have to try to sort out the problem themselves. if that doesn't happen, the buyer then has to pay postage costs to return the item to the seller. those costs are not able to be claimed back, but ebay 'encourages the seller to pay' (yeah! right!). once the item has been returned (has to be sent 'signed for') and the seller has acknowledged receipt, the original cost of the item is supposed to be refunded to the buyer. so, what that means is that ebay does the least amount possible to rectify the situation. the buyer loses out for the cost of return postage and the original cost. the seller gets to keep the money when the item was purchased, fails to sign to say the item has been returned but gets it anyway, so has both money and item.

i'm trying to figure out how this can be a buyers protection policy? the seller gains most, the buyer loses all.

i'm trying to figure out how this can be a buyers protection policy? the seller gains most, the buyer loses all.

If you do your homework, the buyer has nearly all of the power in an eBay transaction. A smart buyer takes almost zero risk while most sellers are left to twist by eBay and PayPal's policies.

Also, if someone doesn't sign for a signature-required package, they don't get the package. And if they do get the package, the sender gets the value of the package back from the shipper for failing to provide the service properly. My company will sometimes get checks directly from UPS because their driver screwed up and did something like this.

What's even more astounding is that PayPal allows the same thing to happen. I have a fairly generic @gmail.com address so I get lots of miss directed e-mail. Someone managed to register a paypal account, link it to their bank account, and buy minecraft (ha) all while using my e-mail address. I got multiple e-mails from paypall asking to verify the e-mail address (which I never did), but they let the person use the account anyway. It would take me about 5 minutes to reset the password, take over the account, and wipe out their bank account.

I called up PayPal and reported this to them as a clear security problem, but they were as useless as expected. They couldn't quite get past the point of asking me for my account information (I don't have a PayPal account).